CVE-2011-0738: Input Validation
MyProxy 5.0 through 5.2, as used in Globus Toolkit 5.0.0 through 5.0.2, does not properly verify the (1) hostname or (2) identity in the X.509 certificate for the myproxy-server, which allows remote attackers to spoof the server and conduct man-in-the-middle (MITM) attacks via a crafted certificate when executing (a) myproxy-logon or (b) myproxy-get-delegation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0738?
CVE-2011-0738 is considered a medium severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2011-0738?
To fix CVE-2011-0738, it is recommended to upgrade to a version of MyProxy newer than 5.2 or Globus Toolkit newer than 5.0.2.
What software is affected by CVE-2011-0738?
CVE-2011-0738 affects MyProxy versions 5.0 to 5.2 and Globus Toolkit versions 5.0.0 to 5.0.2.
What type of attacks can CVE-2011-0738 enable?
CVE-2011-0738 can enable remote attackers to spoof the myproxy-server and conduct man-in-the-middle (MITM) attacks.
What components are improperly verified in CVE-2011-0738?
CVE-2011-0738 involves improper verification of both the hostname and the identity in the X.509 certificate for the myproxy-server.